erroneo.us
Search all guides⌘K

Security Digest · Nov 19, 2019 · Vulnerability · Network edge

FortiOS CVE-2019-6693: Hard-Coded Backup Key Now in KEV

A hard-coded FortiOS key lets anyone with a config file decrypt VPN passwords and other secrets. Linked to Akira. Enable private-data-encryption and rotate.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

Upgrading alone does not fix this: unless private-data-encryption is enabled, every FortiGate config file still protects its secrets with a key attackers know, so check the setting and rotate anything in leaked configs.

Who must act: FortiGate owners who have never enabled private-data-encryption, and anyone whose unencrypted config backups have left the device, through file shares, tickets, forums, repositories or an earlier FortiOS compromise.

Who can relax: FIPS-CC mode FortiGates, which Fortinet says are not affected, and devices with private-data-encryption enabled whose older backups were password-protected or whose secrets have since been rotated.

Affected
FortiOS 6.2.0
FortiOS 6.0.0 through 6.0.6
FortiOS 5.6.10 and below
Later FortiOS versions while private-data-encryption remains disabled (the default)
Fixed in
FortiOS 5.6.11, 6.0.7, 6.2.1 and later, with private-data-encryption enabled
FortiOS 7.6.1 and later generate a random private-data-encryption key when the setting is enabled
CVSS
6.5 (v3.1, NVD)
EPSS
6.6% (percentile 94)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Medium

What to do

  1. Check each FortiGate with get system global | grep private-data-encryption.
  2. Enable it (config system global / set private-data-encryption enable / end), following Fortinet's HA and FortiManager caveats.
  3. Always password-protect configuration backups, and take fresh backups after enabling the setting.
  4. Find old config files on shares, tickets and repositories and treat their ENC secrets as exposed.
  5. Rotate local VPN user passwords, LDAP and RADIUS secrets, IPsec pre-shared keys, certificate passphrases and the HA password found in any exposed config.

How to check if you are affected or compromised

  • Search file shares and repositories for FortiGate configs with grep -rlE "set (passwd|password|psksecret) ENC".
  • Review FortiGate VPN event logs for successful SSL VPN or IPsec logins by valid users from unfamiliar addresses or hosting providers.
  • Check whether the device was ever hit by a config-leaking FortiOS bug or appeared in the January 2025 Belsen Group leak, and rotate its secrets if so.

What happened#

In November 2019, Fortinet published FG-IR-19-007: FortiOS encrypted the "ENC" secrets in its CLI configuration and backup files with a single hard-coded key. Anyone who holds a config file and knows that key can decrypt the secrets. Per the CVE record, that covers users' passwords (but not administrator passwords), private key passphrases and the HA password. Fortinet's advisory says it applies to all ENC credential data except admin passwords, and calls exposed ENC data "easy to decrypt." NVD scores it 6.5. The same advisory covers CVE-2020-9289, the equivalent issue in FortiManager and FortiAnalyzer.

Fortinet's fix was not a new key. FortiOS 5.6.11, 6.0.7 and 6.2.1 added an opt-in private-data-encryption setting that encrypts secrets with an administrator-supplied key instead. The setting is disabled by default.

The bug sat outside the KEV catalog for more than five years. CISA added it on June 25, 2025, citing "evidence of active exploitation" without details, and marked it as used in ransomware. The Hacker News connected the listing to vendor reporting on Akira. Qualys and AhnLab ASEC (February 2025) list CVE-2019-6693 among the flaws Akira uses for initial access, alongside FortiOS CVE-2022-40684. CISA has not described a specific incident.

Who is affected#

The listed versions are FortiOS 6.2.0, 6.0.0 to 6.0.6 and 5.6.10 and below. In practice, any FortiGate where private-data-encryption has never been enabled still writes secrets under the known key, whatever its version. FIPS-CC devices are not affected. The flaw only matters once an attacker has a configuration file. Unprotected backups on file shares, configs pasted into tickets or forums, and configs pulled through other FortiOS bugs all qualify. In January 2025 the Belsen Group dumped FortiGate configs and passwords allegedly from 15,000 organizations, mostly dating from 2022, Rapid7 reported.

Do you really need to act?#

Patching alone does not settle this one, so check two things. First, is private-data-encryption on? If not, every future backup is readable by anyone who gets it. Second, has an unencrypted config ever left the device? If so, assume the VPN user passwords, LDAP and RADIUS secrets and pre-shared keys inside it are known. A decrypted VPN password is a quiet way in, which suits ransomware crews.

What to do now#

  1. Check the setting: get system global | grep private-data-encryption.
  2. Enable it with config system global, set private-data-encryption enable, end. On FortiOS 7.6.1 and later the device generates a random key; older releases ask for 32 hex digits. Read Fortinet's HA and FortiManager notes first, and note that re-enabling it later breaks restores of older backups.
  3. Password-protect every backup, as the advisory's workaround says, and take a fresh one.
  4. Rotate the secrets in any config that has left the device, and require MFA on VPN logins.

How to tell if you were hit#

Decryption happens offline, so the device logs nothing when it occurs. Find the exposure instead. Search shares, ticket attachments and repositories with grep -rlE "set (passwd|password|psksecret) ENC" . to locate FortiGate configs. Then review VPN event logs for successful SSL VPN or IPsec logins by valid users from unfamiliar addresses, especially hosting providers, since a stolen password produces a clean login.

Timeline#

  • — Fortinet publishes FG-IR-19-007.
  • — CVE-2019-6693 is published.
  • — The Belsen Group leaks FortiGate configs allegedly from 15,000 organizations.
  • — AhnLab ASEC lists the CVE among Akira's initial-access flaws.
  • — CISA adds CVE-2019-6693 to KEV.
  • — CISA's remediation deadline for federal agencies.

Vulnerability records

  • CVE-2019-6693 · KEV 2025-06-25 · Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Fortinet PSIRT — FG-IR-19-007: Hardcoded symmetric key in fips.c fortiguard.com
  2. Fortinet — FortiOS 8.0.0 release notes: FortiManager support for updated FortiOS private data encryption key docs.fortinet.com
  3. Fortinet — FortiOS 7.6.3 release notes: FortiGate cannot restore configuration file after private-data-encryption is re-enabled docs.fortinet.com
  4. CVE record — CVE-2019-6693 cve.org
  5. NVD — CVE-2019-6693 nvd.nist.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2019-6693 cisa.gov
  7. CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (June 25, 2025) content.govdelivery.com
  8. Qualys — Threat Brief: Understanding Akira Ransomware blog.qualys.com
  9. AhnLab ASEC — Detecting Akira Ransomware Attack Using AhnLab EDR asec.ahnlab.com
  10. Rapid7 — Fortinet Firewalls Hit with New Zero-Day Attack, Older Data Leak rapid7.com

Coverage and analysis

  1. The Hacker News — CISA Adds 3 Flaws to KEV Catalog thehackernews.com